Last updated 1 October 2026.
Who controls your data
Cortex Peptides is the data controller for personal data collected through this site. Our contact address is Cortex Peptides, Office 1814, 92 Castle Street, Belfast BT1 1HE, and you can reach us at cortexpeptides@gmail.com. The statutory details of the company behind the brand are on our legal information page.
What we collect
When you place an order: your name, delivery and billing address, email address, and telephone number where you give one, together with your order history.
When you contact us or join our mailing list: your email address, your message, and the date and time you gave consent along with the IP address you gave it from. We record the consent evidence because data protection law requires a controller to be able to demonstrate consent was given, not merely assert it.
When you enter the site: a record that you confirmed you are over 18 and are purchasing for research purposes.
Automatically: your IP address, browser type and the pages you visit, in our server logs.
Payment is handled by our payment provider through open banking. We never see or store your bank credentials or card details.
Why we process it, and on what legal basis
- To take and fulfil your order — performance of our contract with you.
- To keep tax and accounting records — compliance with a legal obligation.
- To keep the age and research-purpose confirmation — compliance with a legal obligation, and our legitimate interest in being able to show we sell only to those who confirmed both.
- To prevent fraud and keep the site working — our legitimate interests.
- To send marketing email — your consent, which you can withdraw at any time using the unsubscribe link in any message we send.
How long we keep it
Order and transaction records: six years after the end of the financial year they fall in, as UK tax law requires.
The age and research-purpose confirmation: six years, kept alongside the order it relates to. It is the evidence that a sale was made on the terms we state, so it is of no use to us for a shorter period than the order record itself.
Mailing list entries: until you unsubscribe. We keep the record of the unsubscribe itself so we do not contact you again by mistake.
Contact and trade enquiries: three years from your last contact with us.
Server logs: 30 days.
Who we share it with
We do not sell your data and we do not share it for anyone else’s marketing. We use the following processors, each of which handles data only on our instructions:
- Namecheap, Inc. — website hosting and email. All site and order data is stored on their servers.
- Fena Labs Ltd — payment processing by open banking. Authorised and regulated by the Financial Conduct Authority. They receive what is needed to take your payment.
- Anthropic, PBC — the question-answering assistant on our product pages. If you use it, the text of your question is sent to them to generate an answer. We do not send them your name, address, order history or any other customer record, and we ask you not to type personal details into it.
- Royal Mail Group Ltd — delivery. They receive the name and address needed to deliver your parcel.
- Meta Platforms, Inc. — only if you choose to contact us on WhatsApp. That conversation is covered by WhatsApp’s own privacy terms, not ours.
We may also disclose data where the law requires it, for example to HMRC or to a regulator or court.
Our mailing list is held in our own database on our own hosting. It is not held by a third-party marketing platform.
International transfers
Two of our processors are in the United States, which means your data is transferred outside the United Kingdom:
- Namecheap, Inc. — our server is located in Phoenix, Arizona. Site, order and customer data is stored there.
- Anthropic, PBC — questions typed into the site assistant are processed in the United States.
These transfers are made under the UK International Data Transfer Addendum to the European Commission’s standard contractual clauses, or under the UK Extension to the EU–US Data Privacy Framework where the provider is certified under it. You may ask us for a copy of the safeguard relied on for any transfer.
Cookies
This site sets only cookies that are strictly necessary for it to work, which is why you are not asked to consent to them:
- A cookie recording that you completed the entry confirmation, so you are not asked again on every page.
- Cookies that keep your basket and checkout session working while you shop.
We use no analytics, no advertising pixels and no tracking cookies of any kind. Our fonts are served from this website rather than from a third party, so loading a page does not disclose your visit to anyone else.
If this changes, we will ask for your consent before setting any non-essential cookie, and this page will be updated first.
Your rights
You have the right to ask us for a copy of your data, to correct it, to erase it, to restrict or object to how we use it, and to receive it in a portable form. Where we rely on your consent, you can withdraw it at any time.
To exercise any of these, email cortexpeptides@gmail.com or write to Cortex Peptides, Office 1814, 92 Castle Street, Belfast BT1 1HE. We will respond within one month.
If you are unhappy with how we have handled your data, you can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.